hxxps://eforms[.]august-debouzy[.]com/form/5f8929e35ee0ca5411d0cb84f009f19b3c75be3a1dd0a01686fd15fd2a475c1d

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eforms.august-debouzy.com/form/5f8929e35ee0ca5411d0cb84f009f19b3c75be3a1dd0a01686fd15fd2a475c1d
Sample260803-lv7xtsff49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302243516724760"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{29553B92-5489-473A-81C9-B21075C0AE6B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3772	2640	msedge.exe	85
PID 2640 wrote to memory of 2076	2640	msedge.exe	87
PID 2640 wrote to memory of 2052	2640	msedge.exe	88
PID 2640 wrote to memory of 2052	2640	msedge.exe	88
PID 2640 wrote to memory of 2052	2640	msedge.exe	88
PID 2640 wrote to memory of 3748	2640	msedge.exe	89
PID 2640 wrote to memory of 3748	2640	msedge.exe	89
PID 2640 wrote to memory of 1888	2640	msedge.exe	90
PID 2640 wrote to memory of 1888	2640	msedge.exe	90
PID 2640 wrote to memory of 1888	2640	msedge.exe	90
PID 2640 wrote to memory of 4564	2640	msedge.exe	91
PID 2640 wrote to memory of 4564	2640	msedge.exe	91
PID 2640 wrote to memory of 4564	2640	msedge.exe	91
PID 2640 wrote to memory of 1160	2640	msedge.exe	92
PID 2640 wrote to memory of 1160	2640	msedge.exe	92
PID 2640 wrote to memory of 1160	2640	msedge.exe	92
PID 2640 wrote to memory of 2084	2640	msedge.exe	93
PID 2640 wrote to memory of 2084	2640	msedge.exe	93
PID 2640 wrote to memory of 2084	2640	msedge.exe	93
PID 2640 wrote to memory of 4012	2640	msedge.exe	97
PID 2640 wrote to memory of 1256	2640	msedge.exe	98
PID 2640 wrote to memory of 4012	2640	msedge.exe	97
PID 2640 wrote to memory of 1256	2640	msedge.exe	98
PID 2640 wrote to memory of 3264	2640	msedge.exe	100
PID 2640 wrote to memory of 2296	2640	msedge.exe	105
PID 2640 wrote to memory of 2296	2640	msedge.exe	105
PID 2640 wrote to memory of 2296	2640	msedge.exe	105
PID 2640 wrote to memory of 4308	2640	msedge.exe	106
PID 2640 wrote to memory of 4308	2640	msedge.exe	106
PID 2640 wrote to memory of 4308	2640	msedge.exe	106
PID 2640 wrote to memory of 4976	2640	msedge.exe	109
PID 2640 wrote to memory of 4732	2640	msedge.exe	110
PID 2640 wrote to memory of 4712	2640	msedge.exe	111
PID 2640 wrote to memory of 3920	2640	msedge.exe	116
PID 2640 wrote to memory of 3920	2640	msedge.exe	116
PID 2640 wrote to memory of 3920	2640	msedge.exe	116
PID 2640 wrote to memory of 2668	2640	msedge.exe	117
PID 2640 wrote to memory of 2668	2640	msedge.exe	117
PID 2640 wrote to memory of 696	2640	msedge.exe	125
PID 2640 wrote to memory of 696	2640	msedge.exe	125
PID 2640 wrote to memory of 696	2640	msedge.exe	125
PID 2640 wrote to memory of 4140	2640	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eforms.august-debouzy.com/form/5f8929e35ee0ca5411d0cb84f009f19b3c75be3a1dd0a01686fd15fd2a475c1d
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a0
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,4402879507222774557,8812521496991084666,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,16522316107276339066,3598525694639819766,262144 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,1738237320013013513,13093944864121846684,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17162559467080861947,3212390483962935975,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14461486106709983266,10846559009686692853,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,16814532185371763143,10520416811463930382,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,7329350069814177485,7433514183338444491,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,2933811683070392158,14726265417398445439,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,10950549934669794957,9895865338602454929,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2984058811645801839,11205442568946918947,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2984058811645801839,11205442568946918947,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6396,i,13036257767621041222,14903887928356925042,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3516,i,16305257044388385766,14755895227115104893,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,11272340846894106882,7458538756176884645,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,1755757305828024026,3067895141111151320,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,12490378125334006963,5560766834791772202,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3636,i,3601495904591959102,17758659693403840271,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,8904469110959390145,3906564797851443510,524288 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6536,i,14024507001717349089,8635153768567490030,2097152 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2512,i,9039798261568308203,3619392860047322387,262144 --field-trial-handle=2848,i,17065483413108830594,11550112709591859920,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4ef4e0e1bbcee0e96be8a679acc069777f85e225ffc19f0f22c02542837af679
MD5 9e22390221f7e7b478f218ddd3d38e74
SHA1 b204dc37d34241348e59a7f7faa05490987ea939
SHA512 d5daaf7ded3ab7eeeee3fdd9f77c0d0d24757b64ed687db8d18ee721766f1465113e31b359c28d3c92089f6fe6534b2c5055d83857fccd70298b60306c7d6f1f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T19FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5389d56fe842ae5bac14f0603ff9902b61e5b271e3db8e0797e0e3f1db8ff0c2
MD5 fa25d5d1f84f1631b4345ebb6a1512a4
SHA1 38df08fa4fbbd77bd1a6d053d30bd76c9adf0f78
SHA512 adb8c5958773e22f024c50bf608ce91190b593c846039287ebd0ec399a570c31fbf508a924c7f0fa9a7f25be046cc6ab3da2d6d49d94ba03cc0feb1b1a552b64
TLSH
T1D9713C7911D227A6E38A3633E2F2160A30708FA90F037D211174F93ED809B16673ADF8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d731.TMP
Size 3KB
SHA256 d1c67d0a062981c55ee49849166abc2aaa805d6daf8e4141bc0d76741bf36f69
MD5 ae94895097e6ec3d574799a5c6375bad
SHA1 609d1c233bb2a953554407978db838edb50f3731
SHA512 498b297a6a32f5ccab9a38aa3468f70d8b791d8120fc968781617d73cf929c8041b7ccb9329bb5766220410d97f4448e1034967dd81366a09fee15b71fdcccfa
TLSH
T18E712B7911C227A6E38A3533E2F2160A30708FA90F137D211074FA3ED809B166776EF8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8797d42e5e6b7afcda4e59ef6beef7e3f951056a5ee51c23bf0f7b8531f86451
MD5 d0d7ea160e8ba95655365565773adf69
SHA1 6d75a8e2c183cad1bf9b4ef97a28b55c8e059130
SHA512 9945979877eee6af9f90891c8597d0e0523dba1081c744fd85ce4ce611ed3f44b273ab48ccd114b4aef97a5f783d7aae26278b3818be70bd68c2a42dd8e65dbc
TLSH
T1BD117DF3C3D5856E891557F05A24AE2BCE2D0606821C7C1985D4FF2BD3E3475E00159B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 78ab740a411727f5f5b012d56ba1bd31a424d805e4c650db067b6f8f86ca14e2
MD5 b9903fdb02a27e3d6ebbd5a211641d8d
SHA1 8778e30e835acd98fa74cedca058ec7f7dda7722
SHA512 82509144c92f84c73250024a71e05839028c99be0af12f4f0d031d3de1ec31867a62adcf86ac4b562f3ecfd605e36334d1bc0405078808bbfa1aa305d6444f9c
SSDEEP 192:sxZg3RqyM/jK1Ml8Mka7/f6yshFHXeIdpJHW6+WNGY4kl8PIgrJ:sxZg3YMa7/f6ys7HXPJHbGf9
TLSH
T13742E7016A38A977CCDBD209FA557F53D6F9046392940E48A9FCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 51bb61968e4adf45f6a53658aaccfc8b93bec543529120ca671107e4bf05ccbc
MD5 bb26e0a9190cffe8ab4b7be09a29e0f7
SHA1 b18d3d7a69a32cd0f5ea41293daa2ea77a62a5a3
SHA512 19c8ef22c6147a27cfa8c2c09ff6d94c6a3778314a2ed2372aa8b403fa907ea57c1f2bb130c5c9af00383747f58268051c3e28abf245670710aab81b3075c439
SSDEEP 192:sxZg3RqyM/jK1Ml8UQoka7/f6ysHFUmeIdpwKHW6+WNGY4VK3PIg5CJ:sxZg3YqLa7/f6yslUmP3HbGOM
TLSH
T13452D7126A385977CCDBD209FA51BF53D6F5047392910E88A9FCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1417583a474f0eeaeea524b6dfe129f77cdb44e46d5faa4c9913db465354cfc7
MD5 2f5a8f106b39b630058ded19a6b586c4
SHA1 a8b4f5fcd3b890bc3ef2de57ce9877ad148b59ef
SHA512 a2159c10f0da39ac3f8f00120cef252b4f16aec7ee2c052834034a7665ecd165a124875f07f715dc74844a6f77b164dc2fc49c98f9ecf3558009ff525612c6df
SSDEEP 768:Lr8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdQroVkiUnP:Lr8iJPNWvx76ru1jahALocd7bUP
TLSH
T10BD2FA3B680CCB7E4F844E9CEC266F966ED801CB5B984D5447FA884C03C76EA512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 957d1368a633e18361012edd200ddb8e1bfcf6fb94f71aec6db46d2802ab667e
MD5 7bc273e013c309799f1ccb66a5ff37a4
SHA1 48d8147d858e0315e0e00cdfd3209b54b9f9f94d
SHA512 01f0b45d38eaf01492e0fc459b314cd951f9feb13d90fc13610ed6843830b40bbf78c1885d25c2343059d9e261e267783a5588c461ab58c24cc31675a374b41c
SSDEEP 48:KV9IhKe0sbyV1INKGQAuRIRKqU8bygojkIKyi2QR:KV9aKe0yG12KGQZRSKqUa/ojkIKyi2QR
TLSH
T197A12221F0BE53413C3E2A0DA66596260782B5A33019E46B7BE950B64F6BF250DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597277.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 22bb75cf02585abe42b25ee208cd3455a43c457a1b971a4a86005aec34acf01c
MD5 b57cc7a42a1a7593a247a1d1a439af2a
SHA1 919442a3bc885339ff2c5eacf8c93f4d963fb340
SHA512 80e87439dea6f279fcc0b7b9bf29f78e987e4534c0e15b70f3b14b3d2e46216cbaab0e43ac92c45a4b33bdd5c556e2171bce40460d36c4d3bdeff469cc3c4d4f
SSDEEP 192:urLsNshQX30nYsmhyIQmiU1lgi4k035jzorkbrav7XHNNoQLIasqvrdy:osNsh60YhhPgNkg8kyv7XLotWJy
TLSH
T121422B3668786C6B5DE3A581F10B3613AEF4852B9BC92F94E9ED5B1C00DA29C130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 958850b47338fc28dbbc6fee1453c34cdfe45ad303a7283cd60f5449fc67dba8
MD5 6eb2a2d8ab7c7dd8444e3c374d87d78c
SHA1 5a5d3355b2bdb685fbbb9e355173e36c40a27ceb
SHA512 06428395de22c5ebf1c82f284f538f17189f1286d1539a08fe2e97e7c5a6a4c8ed0b4aeeb5fe7283f9b9fb196c14ed1f7d3132ef462d1ba6ac495ddc8407c285
SSDEEP 192:u7m+xasuheOwQxMGsNsTQX30nYsmhyIQmiU1lgi4k035jzorkbrav7XHNNoQLIay:tZcIhsNsT60YhhPgNkg8kyv7XLotWJu
TLSH
T1DB727D3268786C3B6DE7E581F54A36139EF48027E7C96F94E5FD6B1C00DA298130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2d5e28aa49da596cb583366defd0cf02ed02fc101c40fbf27f58076715c4e24
MD5 8db8b3791e5c55b0e21f138e0b22dcef
SHA1 9cea2d0c6005e47c2fa0d96baea6164ef68f9349
SHA512 83ca9c7989d8672bf2b42ec3f0fca9476037870da82b2c97b5a2113584a93d82fcf463b096903b2f9be8965228af8cd45dd4dc97de1620a1636680d32c1ef454
SSDEEP 192:gONv6kDfQmiUy2WZ9035jzorkbravWQiajaU6:gONv6gh6Z9g8kyv0JU6
TLSH
T11C02EA3568782C7B8EF3AD49B44B27275FE5112BEAD52F84DAE8171C40C725C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e87fb5cf954159de8ad1b6d890d1c0c76648c6d47b480111fa90d6f884d7411
MD5 648a16bf868e617997501249645a636b
SHA1 6c3521ab438fda8b590da481120f4be98a622693
SHA512 2cc2a8d8f0f6b15408db887b755c14da2d6299dd6e0a73e99f3d962a2a1ded1384fc7c16c30cc1bc1649aa473ab40f3c4470e3e0e7bd1951e89dec5fece7cc12
SSDEEP 192:PON96k/QmiUyIWP9035jzorkbrav7XHNNo9cRasqvU6:PON9606P9g8kyv7XLoSWU6
TLSH
T153122C3268786C6B5DD3A995B44B36239EE5412BEBCD7F94E5EC1B1C00DF29C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a817884309975532ad90c1c09c141aec93ba11493350d28f4aac5d480c700f77
MD5 eba40a0e159abfe179e5325005c20635
SHA1 3ae6bc16888fcdb089c0afd07c3a4c46fb3ff604
SHA512 307cf1190185c25701d60869d0883ac700c9607bdaa08365f1aa2cdf6b099f0a3102c85fa5a514fd0eebd1a11aeaabef23ff153c21ad72c8599f4460e9ab1e6c
SSDEEP 384:PiFiZcIFzsNk8TUNTUlIl860YhhPgNkg8kyv7XLoMWJu:aFQ99wgLY2bsMWJu
TLSH
T10B926D3358A8983BADF7AA81F54E32139EF48037D6C9ABD4E6ED5B1C00971DC130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

281914b9-4b36-46f3-ab70-9ec7ee994324.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\281914b9-4b36-46f3-ab70-9ec7ee994324.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bbae9c99aa5490d1d07593fc3ca4f74eda29449724bec49a8aef41338b2fbd49
MD5 76b9f6cae8a72b698f36723e23547fb6
SHA1 bd8cd00d4b3720ff34c98bcabe02a2f1e4ce69a4
SHA512 8286fbba07354872a57d62aed5fdd2bf8711d87315defde64df65a25295e7a99dd6ac2e43fb612f763a1f28ca08cd6a67f00c9d4628272fd1a1d0cde246c0cf9
TLSH
T17141F859AAE91148B3777F5A9BF7A86D487EB9272E06D45E00010D8F0B22E40D871B73
MD5 SHA1 SHA512 TLSH

Submit Download